CVE-2024-29026 Owncast cross origin request
A lenient CORS policy allows attackers to leak the admin password via cross-origin requests, compromising the Owncast streaming server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29026?
CVE-2024-29026 is a high-severity vulnerability in owncast, published on 20 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.
Which versions are affected by CVE-2024-29026?
3 open source packages ship an affected version, including github.com/owncast/owncast. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/owncast/owncast Go | All versions | 0.1.3 |
github.com/owncast/owncast Go | All versions | 0.1.3 |
github.com/owncast/owncast Go | All versions | 0.1.3 |
Products include Owncast Project Owncast.
How do I fix CVE-2024-29026?
Upgrade github.com/owncast/owncast to 0.1.3 or later.
Is CVE-2024-29026 being exploited?
There is no known exploitation of CVE-2024-29026 in the wild and no public exploit code.
Other vulnerabilities in owncast
- CVE-2023-46480 OwnCast remote code execution vulnerability
- CVE-2022-3751 SQL Injection in owncast/owncast
- CVE-2023-3188 Server-Side Request Forgery (SSRF) in owncast/owncast
- CVE-2021-39183 Unsafe inline XSS Owncast
- CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Sources
Also known as GHSA-v99w-r56h-g23v, GO-2024-3054.